Log in Start free

Vulnerability · Published Apr 18, 2026 · Assigned by GitHub_M

CVE-2026-41242protobufjs has an arbitrary code execution issue

High 8.8

In plain English

A high-severity code injection in protobuf.js from protobufjs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 44.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSprotobufno fix listedUBUNTU-CVE-2026-41242
Ubuntu:24.04:LTSprotobufno fix listedUBUNTU-CVE-2026-41242
Ubuntu:25.10protobufno fix listedUBUNTU-CVE-2026-41242
npmprotobufjs8.0.1GHSA-xq3m-2v4x-88gg
npmprotobufjs7.5.5GHSA-xq3m-2v4x-88gg
npmprotobufjs6.11.6GHSA-xq3m-2v4x-88gg

Affected products (as reported)

VendorProductVersions
protobufjs protobuf.js >= 7.0.0, < 7.5.5>= 8.0.0-experimental, < 8.0.1< 6.11.6

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References